1. Field of the Invention
The present invention relates to the security of cryptographic methods and the cryptographic architecture of a processor used in microelectronic assemblies, such as Smart Cards and the like, in order to prevent security breaches of the same when a Differential Power Analysis (DPA) attack is utilized.
2. Description of Related Art
Cryptographic techniques are well-known in the art. Indeed, they date from at least the time of Caesar when the need to keep certain information secret from prying eyes became important enough for people to find ways to disguise the information by means of codes and ciphers.
Today, cryptographic techniques are in a wide array of applications, both governmental and private. One application of cryptographic techniques is to protect information stored in a Smart Card and/or to protect the capabilities of the Smart Card from unauthorized use or modifications. Cryptographic devices, such as Smart Cards, use secret keys to process input information and/or to produce output information. It has been assumed that the information stored in a cryptographic device, such as a Smart Card, is relatively safe from attack provided that an especially strong cryptographic technique is utilized.
Modern cryptography utilizes transposition and substitution of digital data. Messages to be encrypted, known as plaintext, are transformed by a function that is parameterized by a key. The output of the encryption process, known as the ciphertext, is then transmitted. The received ciphertext is then decrypted, using a key, back into plaintext.
One example where modern cryptography is used is in pay-TV conditional-access systems such as pay channels for cable and satellite television. Smart cards and/or security processors (containing secret keys) are used to decrypt the television signals. Attackers buy a cable or satellite receiver and then attack the smart card or security processor inside in order to determine the secret keys. The cipher text is the information sent from the cable or satellite provider, and the plaintext is the decrypted television signal sent to the television. Thus, it is generally assumed that the input and output information, i.e. the plaintext and ciphertext, is available to attackers, and information about the secret keys is unavailable. FIG. 1 depicts a cryptographic system. An attacker may attack the smart card or security processor by looking for information related to the secret keys that may be leaked via EM radiation, power consumption, timing etc. The leaked information, commonly referred to as side channel information, can then be used by attackers in order to determine the secret key used. One common technique for determining a secret key from leaked or side channel information is known as Differential Power Analysis (DPA). Unfortunately, there is no way to guarantee that power consumption, EM radiation, etc. will not leak certain cryptographic process information being performed by a device and thus obtain information about the secret keys. Therefore, defensive techniques are needed that produce leaked information that is unusable by hackers using correlation techniques such as DPA.
DPA has been utilized successfully within the past several years to determine the secret keys used in cryptographic devices such as Smart Cards, where in particular the digital encryption standard (DES) is used. See, for example, Differential Power Analysis published by Paul Coker, et al., Cryptographic Research of San Francisco, Calif. A tutorial on DPA is also provided in the article, Power Analysis Tutorial, published by Manfred Aigner, et al., of the Institute for Applied Information Processing and Communication, University of Technology, Graz, Austria. As described in these references, in order to utilize the DPA technique, the attacker monitors the power consumption of the cryptographic device. The fluctuations in the power used by the device reflect the operations going on within the device and that, in turn, can be used to glean information about the secret keys stored within the device.
It is emphasized, however, that side channel information other than power consumption information may be studied by DPA to extract encryption keys. Some examples are electromagnetic (EM) radiation and faulty outputs. Unfortunately, there is no way to guarantee that power consumption, EM radiation, and the like, will not leak certain information, and it is believed that it is impractical to expect cryptographic devices, such as Smart Cards, to be completely leak-free in terms of information being able to be discerned by their power consumption, EM radiation or the like. However, defensive techniques can be used that make whatever information is leaked uncorrelatable, even if sophisticated statistical approaches are used, for example, in the DPA process. As such, the present invention is concerned with a solution to the problem of making power consumption information uncorrelatable to the secret keys stored within a cryptographic device, such as a Smart Card.
In the prior art, certain decorrelation techniques do exist. See, for example, U.S. Pat. Nos. 6,295,606 and 6,298,153 to Messerges, et al., and published European Patent Application Number 1,098,469 of Boeckeler.
The decorrelation techniques discussed in published European Patent Application Number 1,098,469 by Gregor Boeckeler, superimpose a random current profile based on a secondary clock CLK2, inserted upon the existing profile of a CPU which is based on a master clock CLK1. Each clock is randomly adjusted in a range between 3-7 MHz. Due to two clocks differing from one another with respect to their center frequencies, the combined current profile is randomized which makes a DPA attacker's job more difficult.
Thomas Messerges, in U.S. Pat. No. 6,208,135, uses a randomized starting point in the set of target bits. Mr. Messerges processes the corresponding target bits in a different order; thus it becomes difficult for a DPA attacker to group related target bits from all the plaintexts of interest in order to perform statistical analyses associated with given target bit positions. However, not only does this approach not conceal the information leaked by a data bus; it also cannot prevent a malicious attacker from using this information to reorder the target bit into the correct bit position.
Mr. Messerges also developed another technique, as discussed in U.S. Pat. No. 6,295,606, that uses a random mask to keep the message and key hidden both while they are stored in memory, and during processing by the cryptographic algorithm itself. However, since the mask is randomly changed, new S-boxes must be updated accordingly, and this takes time. The disadvantage is that this kind of masking operation slows down the DES algorithm by a factor of three to five. In addition, this kind of masking operation cannot prevent an attacker from gathering a 48-bit partial key from Round Sixteen when the results must be eventually unmasked to provide the correct output of the cipher. Thus Messerges' approach becomes vulnerable to DPA after unmasking. With 48 bits now known at Round Sixteen, the remaining six key bits to make 56 can then be exhaustively searched by an attacker. The present approach is computationally faster, and it also can prevent an attacker from gathering the partial key from Round Sixteen of the DES algorithm.
These prior art approaches have certain limitations and therefore need improvement. This invention proposes a unique Random Instruction Mask (RIM) as a countermeasure to the DPA process, effectively making power consumption uncorrelatable to cipher bit values. The present invention has the following advantages over the techniques of Messerges, Boeckler and others:
(1) More Efficient Calculations: The techniques taught by Messerges et al. slow down the DES algorithm by 300 to 500% due to the regular update of the S-boxes. In the present invention, the DES algorithm will be slowed down by approximately 15%.
(2) More Robust: Even in the presence of leaked information for multiple address locations.
(3) Better Protection: 48-bits of a key can be completely concealed in the last DES round, (in DES the output is unmasked at the end of the algorithm thereby exposing the key, which is not solved by the prior art), and
(4) Low Power Consumption: There is an increase in power consumption by less than 1% compared to Boeckeler's random current profiling, which increases power consumption to about 200% during cryptographic operations.
Before discussing the details of the preferred embodiments disclosed herein, additional details related to the DES algorithm and DPA attacks will be provided. If the reader is new to this area, further information may be found in our related U.S. patent application Ser. No. 10/864,556 for an intuitive description of how a DPA attack works and in the following articles, P. Kocher, J. Jaffe, and B. Jun, “Introduction to Differential Power Analysis and Related Attacks,” 1998, Thomas S. Messergers, Ezzy A. Dabbish, and Robert H. Sloan, “Investigations of Power Analysis Attacks on Smartcards”, in Proceedings of USENIX Workshop on Smartcard Technology, Chicago, Ill., May 1999, pp. 151-161, and Manfred Aigner and Elisabeth Oswald, “Power Analysis Tutorial” Institute for Applied Information Processing and Communication University of Technology Graz, Austria. The following discussion is offered to provide a context for a detailed explanation of the present invention.
The DES algorithm is an example of an iterative-block cipher. DES is described in detail in ANSI X.392, “American National Standard for Data Encryption Algorithm (DEA),” American Standards institute, 1981, which is incorporated by reference herein. The DES cipher is well known and utilizes a number, typically sixteen, of substitution-permutation box (SP-Box) functions instituted in program sequences called rounds. The SP box functions are non-linear and are conventionally implemented using lookup tables or Boolean logic gates or appropriately programmed computers. In each of the sixteen rounds, the DES encryption algorithm performs eight SP box operations, in turn, by accessing sequentially each lookup table (or by using equivalent logic gates). The eight SP boxes each take, as input, a scrambled 6-bit key, (here, scrambled means that the key has been XOR-ed and shifted) and produce a 4-bit output target to be accessed by the CPU for OR-ing operations. Each such 6-bit scrambled key is an SP box's entry address. Table 1 shows the C-language representation of SP boxes 1 and 2 in a 32-bit implementation of DES. DES can run with 16, 32, and 64 bits but we have chosen the 32-bit representation as a nominal example. From Table 1 note that each SP lookup contains 64 elements. Each element in a nominal DES implementation is 32-bits and embeds a given 4-bit output target. This embedding will now be described in greater detail.
The data bus is 32-bits wide, this 4-bit output target is distributed somewhere within a 32-bit word according to the permutation rules (one per SP box) as implied in Table 1, where the data is presented in a hexadecimal format. That is, each SP lookup table will have a different embedding position for a given 4-bit output target. For example, lookup table SP1, shown in Table 1, embeds a 4-bit output target at bit positions 24, 16, 10 and 2 in a 32-bit word. Lookup table SP2 embeds a 4-bit output target at bit positions 20, 5, 31 and 15, where bit 20 is the most significant bit (MSB) and bit 15 is the least significant bit (LSB) for a given 4-bit output. As a further illustration, the first four entries of lookup table SP1, i.e., SP1 [0:3]={0x01010400L, 0x00000000L, 0x00010000L, 0x01010404L} have 4-bit output target values of 14, 0, 4, 15. Specifically, SP1[0]={0x010400L} is embedded with a 4-bit output target value of 14 (i.e, 1110). For example, for SP1[0] the 32 bit binary word is 0000 0001 0000 0001 0000 0100 0000 0000. The right most digit is the LSB while the left most digit is the MSB for a given 32-bit binary word. To derive the 4-bit output target, the values of the bits at 24, 16, 10, and 2 are used. For example, for SP1 [0] the 4-bit output target is 1110. This is determined by looking for the MSB value of the 4-bit output target at position 24, the next bit is at position 16, the third bit is at position 10, and finally the LSB of 0 is at position 2 of the 32 bit binary word SP1 [0]. The bit positions, 24, 16, 10 and 0 are underlined in the binary representation given above. The fourth entry SP1[3]={0x01010404L}, (which differs from the 1110 of SP1 [0] only at the LSB), has a 4-bit output target value of 15 (i.e., 1111).
On the other hand, the lookup table SP2 illustrates different embedding bit position scheme as shown in the first four entries of lookup table SP2, i.e., SP2[0:3]={0x80108020L, 0x80008000L, 0x000080000L, 0x00108020L.} Only the contents at bit positions 20, 5, 31 and 15 are changed to reflect the values of 15, 3, 1, 13 for the corresponding 4-bit blocks. In particular, the first entry of lookup table SP2, SP2[0]={0x80108020L} has a 4-bit output target value of 15 (i.e., 1111) because bit 20, 5, 31 and 15 all have a value of 1. The fourth entry SP2[3]={0x00108020L}, (which differs with 1111 of SP2[0] only at the 2nd LSB), has a 4-bit target value of 13 (i.e., 1101).
Having established the relationship between the 4-bit output target and its corresponding SP box's entry, next the calculation of a given SP box's entry address is discussed. In general, a DES algorithm uses shifting instructions running in the CPU to calculate a box's entry address. Both the number of shifting instructions used in a specific SP box's entry address calculation and the time interval between each consecutive access of an SP box will be well known to anyone who is familiar with the DES algorithm. In view of this fact, DPA attacks are focused on aligning the power traces of each 4-bit output target of an SP box by referencing the preceding shifting instruction signature unique to that box. As shown in Table 2, under conventional operation, the accessing of each SP box is preceded by a different amount of shifts: >>8, >>16 or >>24 (‘>>’ stands for a right shift in the C computer language and thus ‘>>n’ stands for a right shift of n bits). One skilled in the art will recognize that the routine in Table 2 is written in the C computer language. FIG. 2a shows a corresponding time line with normal accessing order for eight SP boxes [SP1 . . . SP8].
In order to align the power traces, a DPA attacker looks for patterns in the power trace. To determine a SP address calculation for SP box 5 (SP5), the DPA attacker looks for a pattern indicating eight shifts as seen in Table 2. In addition, the DPA attacker would know that the time from the beginning of the eight shifts to the beginning of a next set of shifts is equal to a time TI5 as shown in FIG. 2a. Thus, the DPA attacker, when finding this pattern in a power trace, would know that the SP address calculation for SP5 has been found. In addition, the attacker would also know that the information in the power trace for the time slot following the end of the eight shifts would contain the corresponding 4-bit output target information. This information allows for the alignment of the power traces for statistical averaging which provides information regarding the 6-bit key. One skilled in the art will appreciate that power traces are noisy, thus finding instruction signatures and other patterns may not guarantee the success of a DPA attack. However, the instruction signatures and other patterns are available in the prior art for an attacker to use. By destroying these instruction signatures and time patterns, the success of a DPA attack is even more unlikely.
FIG. 2b shows the time line with randomized accessing order for the eight SP boxes. As an illustration in FIG. 2b, the processing order of SP1 and SP3 has been swapped, and similarly for the SP4 and SP6. In this case, it is obvious that a DPA attacker will have to identify these shifting instruction signatures in order to align power traces by re-shuffling the SP box accessing order. After alignment for a given SP box, statistical averaging and other analysis of these power traces can be performed. Thus, the DPA attacker can ultimately align the power traces to determine the 6-bit key.